I have come across many security keys from different manufacturers such as solokeys, yubico etc.., for the purposes of 2FA/MFA. Products vary basically w.r.t features such as USB-A, USB-C, Apple connector or NFC. But, I could not still figure out the reason for having a push button in couple of products whereas the nano products do not have that push button. So, does the push button offer extra security in any manner? or if the push button is not available, is the key open to security risks?
asked Jan 13, 2021 at 16:32
Add a comment
|
1 Answer
YubiKey Nano and Somu (the small variant of a Solokey) use a capacitive way to detect that a user touches the device. There is a small area of metal that protrudes out of the plastic casing that nearly vanishes in the USB socket.
The user presence detection is part of FIDO U2F.
Universal 2nd Factor (U2F) Overview
FIDO Alliance Proposed Standard
Chapter 5
In summary, the user will have to touch a button to register, and may also be warned by the browser. The relying party can put up screens which will walk the user through these steps. Registration is a very high value operation - it gives an origin a capability to very strongly verify a user and it needs to be taken very seriously. During authentication (or more generally, whenever the online service or website needs to strongly verify the user by requesting a signature), the user needs to activate the device to demonstrate user presence before the signature can happen. From version 1.2 onwards, it is possible to ask a device for a signature without user presence. The signature clearly indicates it was made without user presence and will have to treated by the online service or website accordingly.
Other ways exist that work by unlocking the hardware token through the Operating System by entering a PIN or by verification of biometric criteria such as fingerprints.
